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Abstract In a conventional quantum (k, n) threshold scheme, a trusted party shares a secret quantum 
state with n participants such that any k of those participants can cooperate to recover the original secret, 
while fewer than k participants obtain no information about the secret. In this paper we show how to 
construct a quantum (fc, n) threshold scheme without the assistance of a trusted party, who generates 
and distributes shares among the participants. Instead, each participant chooses his private state and 
contributes the same to the determination of the final secret quantum state. 

Keywords Quantum secret sharing • Quantum cryptography • Quantum information processing • 
Quantum communication 
PACS 03.67.Dd 

1 Introduction 

Suppose that n shareholders who are not mutually trusted want to share a password, with which they 
can open the vault and get access to some confidential documents of the company. It should be done 
in such a way that any k of those shareholders have the ability to reconstruct the password, while fewer 
than k shareholders cannot. The solutions vary under two different situations. If there exists a trusted 
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party who generates and distributes suitable shares among the shareholders, then the problem could be 
addressed by classical (fc,n) threshold schemes independently introduced by Blakley [T] and Shamir [2]. 
And if there does not exist such a party trusted by all of the shareholders, then classical {k,n) threshold 
schemes without the assistance of any trusted party came to rescue [SHS] . 

With the emergence of quantum computation and quantum communication, it is natural to consider 
the quantum counterparts of secret sharing schemes. Hillery et al. showed how to implement a classical 
threshold scheme using Greenberger-Horne-Zeilinger (GHZ) states in the presence of eavesdroppers, and 
also showed how to share an unknown qubit between two participants such that only the collaboration of 
two participants could reconstruct the original qubit [5] . Karlsson et al. presented a secret sharing scheme 
based on two-particle quantum entanglement, in which quantum information is sent from a sender Trent 
to Alice and Bob so that both persons are needed to obtain the information, and showed that it could be 
extended to a special quantum (fc,7i) threshold scheme based on multi-particle entangled states [7]. Cleve 
et al. gave an efficient construction of more general quantum {k, n) threshold schemes, where a trusted 
party can share an unknown quantum state with n participants such that k participants are necessary 
and sufficient to reconstruct the original secret quantum state . Thereafter quantum secret sharing has 
been an active research field and many quantum secret sharing schemes using various techniques have been 
proposed [SH2U]. 

Whereas most previous quantum (fc, n) threshold schemes have been considered with the assistance of 
a trusted party [6H20| , here we consider the problem of sharing a quantum secret without having a trusted 
party. Actually, for lots of applications such as conference key agreement and distributed computing with 
faulty processors, quantum secret sharing without a trusted party is a powerful tool. Also, as referred 
by Ingemarsson and Simmons [3], the situation that there is nobody trusted by all of the participants is 
more common in commercial and/or international applications. In this case, previously proposed quantum 
secret schemes do not play the role well. Therefore, in this paper we give a basic construction for sharing 
a quantum secret in the absence of a trusted party and illustrate its feasibility mainly by improving the 
quantum {k, n) threshold scheme presented by Cleve et al. [8] to eliminate the need of the trusted party. 
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The novelty is that a trusted party is unnecessary and each participant acts for his own benefit. 

2 Quantum {k,n) threshold schemes without a trusted party 

In this section, wc show how to solve the problem of sharing a quantum secret without the aid of any 
trusted party, drawing ideas from classical counterparts [SHS]. The problem could be stated more clearly 
as follows: 

• all of the participants choose their own private quantum states, which must be made available in 
sequence for the final secret quantum state to be generated; 

• all of the participants contribute identically to determining the quantum secret; 

• the participants share the secret quantum state in a way that the collaboration of any k out of 
n participants can recover the secret quantum state, but the collaboration of any fc — 1 or fewer 
participants obtain no information about it. 

Such a scheme is called a quantum (fc, n) threshold scheme without a trusted party. In such a scheme, each 
participant acts for his own benefit and need not trust a single party unless at least k participants work 
together. In addition, notice n < 2k for a quantum (fc, n) threshold scheme without a trusted party, which 
is guaranteed by quantum no-cloning theorem [21]. 

The basic method used for constructing a quantum (fc, n) threshold scheme without a trusted party is 
introduced in the following. 

(1) Each participant (i = 0, 1, • • • , n — 1) randomly selects his private quantum state pi which can be 
a component of the quantum secret, or belong to the same domain as that of the secret quantum state to 
be reconstructed. The specific form of the quantum secret can vary with different applications and should 
be defined before implementing the protocol. 

(2) Pi acts as a trusted party and splits his private quantum state pi into n shares pij (j = 0, 1, • • • , n—1) 
using a conventional quantum {k,n) threshold scheme such as [8], and then sends each share pij to the 
participant Pj in sequence (particularly Pi keeps pa). 
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(3) When has received the share pji from the participants Pj, he can do nothing or implement 
corresponding operations on pji and his quantum registers. Note that such operations are agreed before 
the protocol and vary with the conventional quantum [k, n) threshold schemes used. If Pi has received 
the shares = 0, 1, • • • , n — 1) and implemented the corresponding operations by some time (the time 
limit is agreed before the protocol), he announces that he has completed his actions; else if Pi has not get 
the share from some party Pj, he also reveals this fact. 

(4) If at least k parties have not received the shares from some party Pi before the time limit, they 
consider Pi a quitter and not a real player. If the number of quitters is not exceeding n — fc, the protocol 
cannot be affected and just the value of n decreases; otherwise the protocol aborts. After all of the real 
participants have announced, any k participants can cooperate to obtain the final secret quantum state ps 
which each participant's private state pi contributes equally to by a preconcerted way, while less than k 
participants obtain no information about ps except their own private states. 

Note that we should assume that each participant must logically be willing to share the private quantum 
state chosen by himself with other participants and contribute the same to determining the final secret 
quantum state. Otherwise a malicious participant who sends an improper quantum states can make k 
participants reconstruct a wrong quantum secret and thus make the protocol abort, even though doing 
such things is of no use for him. In addition, the security of such a quantum (fc,n) threshold scheme 
without having a trusted party largely depends on the conventional quantum (fc, n) threshold scheme used 
by each participant to protect his private state among the other participants before the recovery phase. 

3 Concrete quantum (fc,n) threshold schemes w^ithout a trusted party 

In order to clarify the feasibility of the construction of a quantum (fc,n) threshold scheme without a 
trusted party introduced by us, wc give a couple of schemes. Besides, it is only necessary for us to consider 
real players' actions, since the construction method has ensured that if at most n — players drop out 
midway, the protocol will not be affected. 

one scheme can be achieved as follows just by utilizing the operations included in a conventional quan- 
tum (fc,n) threshold scheme such as that in [BHH]: each participant shares the private state chosen by 
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himself with the other participants using a conventional quantum (k, n) threshold scheme; if a participant 
has obtained the shares and performed accordingly, he makes an announcement that his task has been 
finished; then any k players recover each participant's private state using the conventional recovery pro- 
cedure; and such k players obtain the final secret from all of the recovered private states by implementing 
the agreed operations. Obviously, the processes of this scheme can accord with that of the proposed 
construction method and the trusted party is removed indeed. Nevertheless, the conventional recovery 
procedure has to be implemented for n times and then the negotiated operations should be applied on n 
private states to obtain a secret. 

Another concrete scheme is based on the quantum (fc, n) threshold scheme presented by Cleve et al. [5]. 
Wc improve it to remove the use of the trusted party. The improved scheme can allow all of the participants 
to choose their own private state and have the same influence on determining the final quantum secret. 

Note n < 2k and that the dimension of each share can be bounded above by 2 max(2fc — 1, to) through 
efficient quantum operations, where to is the dimension of the private quantum state to be encoded, the 
same as that in [8]. In addition, we just need to consider the special case where n — 2k — 1, since a quantum 
(k, n) threshold scheme with n<2k — l can be obtained by discarding 2A: — 1 — n shares from any (fc, 2fc — 1) 
threshold scheme with ti > fc . Our improved scheme without the aid of the trusted party includes three 
parts: scheme setup, secret quantum state generation, and secret quantum state reconstruction. 

3.1 Scheme setup 

Given fc, n and to, find a suitable prime q satisfying max(n, to) < q < 2max(n,TO) (which is always 
possible according to Bertrand's postulate [22]) and set a finite field F = Zq. For i = 0,1, ■ ■ ■ ,n — 1, let 
Ci = (ci,0:Ci_i, • • ■ ,Ci^k-i) £ F'^, define the polynomial as Pait) = c^.o + Q,!^ + • ■ • + Ci^k-it''^^, and let 
Xi £ F and each Xi should be different from each other. Then a g-ary quantum state which is defined on 
basis states \si) {si G F) could be encoded by the linear mapping as 





))■ 



(1) 



Ci ^ F ^ Ci_Ji—\ — Si 
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Define the resulting state of adding a q-ary quantum basis state \si) to tlie quantum register in a q-aiy 
quantum basis state \sj) as \si + Sj)\si) (s^, Sj G F), wliicli can be encoded by tfie linear mapping as 

X] \Pc,{xo) +Pcj{xq), - ■ ■ ,Pci{Xn-l) +Pcj{Xn-l))\Pc,{xo),- ■ ■ ,Pc,{Xn-l))- (2) 

Also define the operation applying an invertible I x / matrix M to a sequence of Z quantum registers as 
applying the mapping 

\{yo,yi,--- ,yi-i)) \{yo,yi,--- ,yi^i)M). (3) 

For zo,zi,--- G F, introduce the Z x / Vandermonde matrix [Vi(zo, zi, • ■ • ,z;_i)]y = Zj G 

{0, 1, • ■ • ,1 — 1}). And notice that 

|(ci,o,Ci,i, ■ • • ,Ci,i_i)V;(zo, zi, • ■ • 

= \Pci{zo),Pc,{zi),- ■ ■ ,Pci{zi-l)), (4) 

where c.^ = (ci_o,Cj,i, • • • ,Ci,;_i) G F'. 

In addition, suppose that each participant Pi (i = 0, 1, ■ • • , n — 1) owns a local quantum register Ri and 
n common quantum registers Ci,j {j — 0,1, ■ ■ ■ , n — 1) and every register is in an initial state |0) (0 G F). 

3.2 Secret quantum state generation 

In this phase, Pi (i = 0, 1, ■ • • , n — 1) will adopt a method of encoding by employing a polynomial of 
degree fc - 1 denoted as PcAt) = Cj,o + Cj,i^ ^ ^ Cj,fe-ii''"\ where q = (ci,o, Ci,i, • ■ • ,Ci,fc-i) G F'''. 

Pi randomly chooses and prepares his own private g-ary quantum state \si) (s; G F) and uses the 
encoding denoted as (HI) to obtain 

X] \Pc,ixo),Pc,ixi),--- ))■ (5) 

Ci G F'',Ci^k-i = Si 
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Note that the above operation imphes that the quantum state |sj) is split into n shares which are stored 
in the quantum registers Ci^j (j = 0, 1, • • • — 1). Then Pi sends the share in the register C^j to Pj for 
j = 0,l,---,n — 1 (including himself) sequently in an authenticated way. 

When Pi receives a share, he adds the received state to the quantum register Ri. And if Pi has obtained 
the shares from all of the participants and implemented all the corresponding operations, he announces 
that his actions have been finished. After all of the participants have announced, it is not difficult to 
obtain that n + ri^ quantum registers Rq, • • • , Rn-i, Cq^, Co,i, • • • , Cn-i,n-i are in a global state 

n— 1 n—1 
i=0 1=0 

Ci e F*"', Q,fe_i = Si 

for z = 0, • • • , n — 1 

Then, let the final agreed secret quantum state be \s) (for s = ^ = ^Ci^fe_i and s E F) if all the 

i i 

participants are required to provide g-ary quantum basis states before the scheme. In this case, we shall 
see that the final secret can be recovered using the conventional recovery procedure only once. However, 
if players can be allowed to provide a superposition of basis states, their private states may entangle with 
the resulting state after performing operations on them. So the final secret state should be defined in a 

n-l 

different way, such as a superposition of states | ^ Si) ®"Jo^ |si)(si G F) or measuring the superposition 

i=0 

ji-i 

state using the computational basis in and taking the collapsed state | the first register as 

1=0 

a final secret. The form of the final secret can vary with the specific applications and should be negotiated 
before implementing the scheme. 

3.3 Secret quantum state reconstruction 

In this part, we show that the collaboration of any k participants can reconstruct the agreed secret 
quantum state \s) by the following steps. Suppose that the first k participants, namely Pq? ^'i; ■ ' ' i Pk-ii 
gather together and want to recover the secret, so we obtain the information about the fist k quantum 
registers (that is, Rq, • • • , Rk~i) and kn common quantum registers (namely, Cij for z = 0, • • • , n — 1 and 
j = 0,-- - ,/c-l). 
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(1) Apply Vk{xo,Xi, ■ • ■ ,Xfc_i) ^ which represents the inverse of Vk{xo,Xi, ■ • ■ ,Xfc_i) to the first k 
quantum registers Rq, Ri, ■ ■ ■ , Rk-i- Then the global state of the n + quantum registers is 

71 — 1 n~l n — 1 n — 1 

5Z \^<^i,0-,--- ,^Ci,k~l)\^Pci{Xk), - ■ ■ ,^Pc.(2:n-l)> ®r=0^ \pci[xo),--- ,Pci{Xn-l)). (7) 

i = i = i = i=0 

Ci G F''',Ci,fe_l = Si 

for z = 0, ■ ■ • ,71—1 

(2) Shift the first k quantum registers by one to the right in sequence by setting Ro, Ri, ■ ■ ■ , Rk-i to 
Rk-i, Rq,' ■ ■ , Rk-2- At this time, the global state of the n -\- 'n? quantum registers is 

n-1 n-1 n-1 n-1 n-1 

^ I a.k-l, Ci,o, • ■ • . ^ Ci.k-2)\ P^ii^k), ■ Pci(Xn-l)) t^'lZd IPcJaio), ■ ■ ■ ,p^.(Xn-l)) 

i = i = i = i = i=0 

a G F'=,Ci.fe_i = Si 

for 2 — 0, • ■ • , n — 1 

n-1 n-1 n-1 n-1 

J2 k>l c,,o,-- ■ , Ci,fc_2)| X^PcJa^fc),--- ■ X!Pci(a;„_i)) 0r=o' bci(2:o),-- ■ ,Pci(a:„-i)). (8) 

1 = i=0 i = i = 

Ci G F'=,Ci.fc„i = Si 

for i — 0, • ■ ■ ,71—1 

If the state in Rq is a basis state |s) (for some s G F), it can be the final secret quantum state and 
the recovery procedure has been done; otherwise we should continue the recovery procedure. Actually, a 
participant usually offers a superposition of basis states, so the register Rq is entangled with the other 
registers, since in ^ the value of |s) can be determined by any of the kets 

n—1 71—1 71—1 Tl— 1 

l^Ctfi,--- ,^C,M-2)\^Pc,{Xk), - ■ ■ ,^Pci{Xn-l)) <E)i^o IPcA^q),- ■ ■ ,Pci{Xn-l))- (9) 
7=0 1=0 1=0 1=0 

(3) Apply Vk-i{xk,Xk+i,- ■ ■ , a;„_i) to the quantum registers i?i , i?2 , • • ■ ,-Rfc-i and add RQ-{xk+i-i)''~^ 
to Ri for all i g {1, 2, • • • , fc — 1}. And the global state of the n + quantum registers is 

n-1 n-1 n-1 n-1 

1^)1 - ■ ■ I]P-,(^"-l)>l IZP-.t^^*")'-- - ■ Z!P-i(=^--l)) '»fco' \Pciixo),--- ^Pa,{Xn-m) 

i = i=0 i=0 i = 

Ci e F'=,C,,fc_i = S, 

for i = 0, ■ ■ ■ , n — 1 

(4) The first k parties perform the similar operations that were applied to the registers Rq, R2, • ■ • , Rk-i 
in steps (1), (2) and (3) of the state reconstruction phase on the registers Ci^oi Ci.ii " ' ' iCi.fc-i for * = 
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0,1,-- - ,n — 1. Then the global state of the n -\- quantum registers should be 

n — 1 71—1 n—1 71—1 

X] \s)\'^Pc,{xk), - ■ ■ ,^Pci{.Xn-l))\^Pc,{xk)r ■ ■ ,^Pci{.Xn-l)) 

i=0 1=0 i=0 i=0 

C,; e F'',C,,fc-l = Si 

for i = 0, ■ • • ,n ~ 1 

'^7=oi\St)\Pc,{xk)r ■ ■ ,Pci{Xn-l))\Pc,{xk), - ■ ■ ,Pc,{Xn-l)))- (H) 

(5) Shift the registers possessed by the first participant Pq (namely, i?o, Cq^Oj " ' ■ iC'n-i.o) to be first 
n + 1 registers. For i = (0, 1, • ■ • , fc — 1), since there is a unique array c; G F'" with Ci^k-i = Si such that 
Pci(^fc+j-i) ~ Vi.j f*^^ ^'^y j ^ 2, • • • , fc — 1}, the state denoted as Eq. (|lip can be rewritten as 

n—1 n—1 n—1 n—1 

i=0 i=0 1=0 1=0 

for i ~ 0, ■ ■ ■ , n — 1 

'X'rJo^dyj.i, ■ • • ,2/»,fc-i)l2/i,i>--- (12) 

From the Eq. (jl2p . if all the participants provide q-ary quantum basis states, the state in Rq is \s) (for 
s = ^ Si = ^ Ci,fe-i and s G F) and it can be the final agreed secret. If some players offer superposition 

i i 

states of basis states, the state of the first n + 1 registers (that is, Rq, Cq.o, • • ■ , Cn-i,o) is a superposition 

n-1 

of the states | ^ Si) ®,"^o^ |si)(si e F) which can be defined as the final secret. We also can measure 

n-1 

the superposition state in the computational basis in and the collapsed state | ^ Si) in Rq can 

i=0 

be considered as a final secret. Note that the the sum of the measurement outcomes of C'ofi, • • • , Cn-i^o 
should equate the value of Rq. If not, there must be something wrong and the scheme should be carried 
out again. The specific definition of the final secret can be adapted to different applications and should 
be established before performing the scheme. 

In summary, the above two schemes where the trusted party is removed demonstrate the feasibility of 
the construction method offered by us. But in the first scheme, the conventional recovery procedure needs 
to be implemented for n times and then the agreed operations on n private states are needed to gain a 
secret . In the second scheme, if all the participants arc required to provide basis states, the final secret 
can be reconstructed using the conventional recovery procedure only once. Nevertheless, if participants 
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are allowed to offer superposition states, the conventional recovery procedure should be employed for n + 1 
times to generate a secret. In addition, the security of these two scheme largely relies on the conventional 
quantum (fc,n) threshold scheme since each participant needs it to protect his private state among the 
other participants before the secret reconstruction phase. 

4 Conclusion 

In this paper, we have given a basic construction of quantum (k, n) threshold schemes without a 
trusted party and illustrated its feasibility by offering two schemes. In contrast to previous presented 
quantum secret sharing schemes j5H20|. in which a trusted party is always needed to assist in generating 
and distributing shares among a group of participants, the schemes suggested in this paper require no 
trusted party and thus might widen the applicability of quantum threshold schemes to the situation where 
there is no single party trusted by all of the participants. 

However, the construction method proposed needs the participants to be logically honest during the 
secret generation phase since they should provide a proper quantum state; otherwise a single participant 
can disrupt the whole scheme and not be detected until the secret reconstruction phase, even though doing 
so is of no use for him. Although it is not quite reasonable to make such an expectation, the main intention 
of this paper is to demonstrate the necessity and feasibility of sharing a quantum secret without a trusted 
party. Particularly, Michael Ben-Or recently suggested us that the techniques used in quantum multiparty 
computation [23l[24] may be exploited to propose quantum secret sharing schemes in the absence of a 
trusted party where less than half of the participants are not required to play honestly during the secret 
generation phase. This invaluable advice shall build a bridge between quantum secret sharing without the 
aid of a trusted party and quantum multiparty computing. How to utilize them comprehensively will be 
the further work. 
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